Security

The Pivotal Payments Gateway (PPG) Server is committed to being secure by design, secure by default, and secure in deployment. The PPG Server protects your payment processing environment as well as safeguards the privacy of your customers with:

  • Strong encryption: Strong Triple DES encryption and asymmetric PKI to protect your sensitive data.
  • Compliance with Visa CISP: The PPG Server is compliant with the Visa's Cardholder Information Security Program and does not store any sensitive data as outlined in the CISP guidelines.
  • Multiple layers of security: Supports multiple layers of access control /authentication methods using both form authentication and Kerberos.
  • Two factor authentication: Supports two factors of authentication using Smart Card.
  • System wide IP filtering: Supports IP filtering across the whole system.
  • User-based IP filtering: Supports IP filtering based on each individual user in addition to the system wide IP filtering.
  • SL: Supports SSL with the strongest key length to protect all traffic to and from the payment server.
  • Clustering security: The PPG Server clustering supports Kerberos authentication against the back end database and supports Internet Protocol security (IPSec) between all the servers in the cluster and the database.
  • Instant alerts: The PPG Server detects intrusion attempts and immediately alerts administrators via email or SMS/pager.
  • Role-based security: The PPG Server supports role-based security using ASP.NET
  • Elimination of buffer overflow exploits: The PPG Server is built using managed .NET code and eliminates many forms of buffer overflow exploits (making up the majority of Internet security threats).
  • Real-time blocking of intrusion attempts: When an intrusion is detected, the payment server can automatically block all traffic from that particular IP address to thwart the attacks.
  • Country blocking: Ability to block traffic based on the incoming IP address' country of origin. You can grant access to a super-user (who has access to reports and refunds, etc.) to come in only from a trusted country, and assign a user with limited functionalities (who can only perform credit card authorization, etc.) to allow shopping carts from any country except those on your black list.
  • Privacy protection in web services and browser-based virtual terminals: All sensitive data such as card number, expiration date, etc. are masked on the receipt as well as the report.

To learn more about certifying your software solution contact us at 1 866 364-9813 or click here.